Arecibo: an OOB exfiltration tool (DNS & HTTP)

09 - Nov - 2018 - Juan Manuel Fernandez

In the process of identifying and exploiting vulnerabilities, it is sometimes necessary to resort to Out of Band (OOB) techniques in order to exfiltrate information through DNS resolutions or HTTP requests. To address this kind of situation the faster and simpler solution can be the use of a Burp Collaborator instance or a online service like requestbin.net, but this has a big disadvantage: both are services hosted by a third party. Local instances of Burp Collaborator or requestbin can be deployed but they are heavy and poorly customizable or adaptable. To suply this need during a RedTeam operation a tool (Arecibo) with an easy API was developed.

0x01 – Introduction

Arecibo is a small tool written in python with following capabilities:

Internally it is composed of two parts, on one hand a python script that interacts with PowerDNS through a “backend pipe” and on the other hand the scripts that act as API (Flask + SQLite3) that allows to add new functionalities easily.

0x02 – DNS interactions

In the first instance, an identification token must be generated via Arecibo API to proceed with the exfiltration of data through DNS:

Using this token a domain such as ABCDEF.3144bd59af63b2ff98b303f3c0eb8f62.x.DOMAIN.ORG can be built, where “ABCDEF” is any string that you want to exfiltrate to Arecibo. Once this domain is resolved, we can see the registered string:

Through the endpoint “hitsdns” we obtain all resolutions associated with the token that we had previously generated, including the exfiltrated information and the timestamp from when it was sent. On the other hand, for dynamic resolution of IPs you only need to use the prefix X.X.X.X.ip.domain.org:

0x05 – Installing and configuring Arecibo for exfiltration

As mentioned at the beginning, it is necessary to have installed pdns (packages pdns and pdns-backend-pipe) and the modules flask and flask_restful for python. The ideal situation is to deploy the API in the local interface and use an NGINX as a reverse proxy to handle authentication and security. Once these requirements are met, the process would be:

(changing the setuid / setgid by the user that will be used to run the service, which will be the same used for the API)

4. Execute arecibo-api.py and pdns_server (the location can change according to distribution)

If everything goes fine:

Note:the server must be configured as Authoritative DNS

Arecibo is up for exfiltration

0x06 – Conclusions

Arecibo is a lightweight tool that brings together the features of requestbin, file.io, xip.io, etc. in a single tool, allowing its easy deployment. It has the advantages of being able to operate easily through its API, so it is a very good alternative to use in penetration tests.

Necesary

Used by the content network, Cloudflare, to identify trusted web traffic

Settings

It's used to serve the user's preferred language on the website

Statistics

These cookies help us to understand how visitors interact with our website, collecting and reporting data about your interaction within our website

Marketing

Marketing cookies are used to track visitor across websites. The intention is to display ads that are relevant and engaging for the individual user an thereby more valuable for publishers and third party advertisers.